Re: 2.6.35.11 bridge drops fragmented packets

Le jeudi 11 août 2011 à 16:44 +0300, Andrei Popa a écrit :

On Thu, 2011-08-11 at 15:39 +0200, Eric Dumazet wrote: 

quoted

Le jeudi 11 août 2011 à 15:43 +0300, Andrei Popa a écrit :

quoted

Hello,

We've got a problem with kernel 2.6.35.11 as it does not forward
fragmented packets on a bridge.
I've seen this thread
http://lkml.indiana.edu/hypermail/linux/kernel/0604.0/0201.html and I
thought to email you.

The command "echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables"
fixes the problem.

The config from the kernel is attached.
The network configuration is as follows:
cisco, interace in mode trunk with allowed vlan 1501,299 -> linux ->
cisco, interface in mode trunk with allowed vlan 1501

The MTU on cisco and on linux interfaces is set to 1500.
Packets with size 1500 and no fragments are forwarded succesfully,
packets with size 1500 and fragments are not forwaded.
On linux it's a bond comprised of eth1.1501 and eth0.1501.
root@shaper_b2b_bucuresti:~# brctl show
bridge name     bridge id               STP enabled     interfaces
br1501          8000.0015170ae7b8       no              eth0.1501
                                                        eth1.1501
I cand see the fragmented packets arriving on eth0 and eth0.1501 but I
don't see them leaving on eth1 or eth1.1501.

Andrei

Could you give us output of 'netstat -s' to check if IP defrag drops
some packets ?

root@shaper_b2b_bucuresti:~# echo 1

quoted

/proc/sys/net/bridge/bridge-nf-call-iptables

On a server behind the shaper:

nl2 ~ # ping -s 65000 lg.telia.net
PING juniperlg1-sn4.m-sp.skanova.net (81.228.10.74) 65000(65028) bytes
of data.
^C
--- 

65000 bytes means 43 frames, and your network seems a bit busy.

If _one_ frame is lost (becasue of shaping for example), IP
fragmentation in bridge will fail -> all frames are discarded.

Could you try with "-s 2000" ?

I could not reproduce your problem on my dev machine (admitidly using a
more recent kernel)